Authorization Bypass in OpenClaw Vulnerability Affecting OpenClaw

CVE-2026-100594

What is CVE-2026-100594?

OpenClaw versions prior to 2026.7.1 are affected by an authorization bypass vulnerability in the /export-trajectory endpoint. This flaw allows unauthorized users to access owner-only trajectory bundles, including sensitive prompts, model messages, tool schemas, runtime events, and local path metadata. By exploiting inadequate authorization checks, attackers can compromise the confidentiality of sensitive information, making it critical for users to upgrade to the latest version to mitigate potential risks.

References